When a ransomware attack encrypts your files and demands money, then paying is rarely your only option, and often the worst choice. We identify the type of ransomware used on your system; recover all types of recoverable files (decryptable variations, shadow copies, backups) and all other non-encrypted files; and maintain a complete record of all your recovered information for use by your insurers and investigators. Our ransomware data recovery service starts with a completely complimentary evaluation of which files can be restored, before you even think about making a ransom payment. This includes server ransomware recovery: if you have an encrypted file server or RAID, we restore the data from the impacted volumes.
Immediately upon identifying the presence of ransomware, isolate the infected computers: remove their connection from the network, and discontinue access to any backups to prevent additional computers from being compromised. Do not format, rebuild or delete anything, and do not make a hasty decision to pay: there is no guarantee that making a payment will result in the release of a working decryptor, and your payment will continue to fund these cyber criminals’ nefarious activities. Retain the ransom demand along with several samples of the encrypted files, and contact us immediately. We determine which type of ransomware has been applied, and some types can be decrypted without requiring a payment.
Modern ransomware is no longer limited to simply encrypting a few of your files. Instead, modern ransomware has the capability to spread to other areas such as additional drives, search for and encrypt your backups, and target the systems that run your business. Below are many of the typical scenarios we encounter.
Before we do anything else we must determine which exact family and variant of the ransomware is responsible for the attack by analysing the ransom note and encrypted samples provided to us. For some strains there exists a free or known decryptor available; for current big families it is not possible to break the encryption, so we will recover data from shadow copies, backups and unencrypted data instead.
Strain identification always comes first — we check the No More Ransom project, run by Europol and police forces to publish free decryptors, alongside our own tools. Whatever the family, we tell you honestly what is recoverable before any work begins.
Depending upon which type of ransomware hit your computer, server or NAS device, our specialists have expertise to assist in recovering ransomware-affected data from every major operating system including but not limited to: Windows, macOS and Linux as well as their respective virtualised platforms. As long as the ransomware was able to reach your data, we can likely provide assistance.
Desktops, laptops and workstations · physical and virtual servers · NAS and SAN systems · current and older Windows, macOS and Linux versions.
Our ransomware recovery services revolve around one simple concept: to obtain access to your data without providing payment to the attackers. This is a specialised recovery service for encrypted data and begins the same way every single time. All forms of ransomware recovery begin by determining the specific type of ransomware involved and never paying blind. In addition to making sure all original equipment is preserved as evidence, we only operate on read-only versions of the affected devices. We also attempt to utilise all avenues for data recovery from the ransomware attack, including but not limited to: using a decryptor, shadow copies created under Windows, backup locations (both online and off-line), unencrypted remnants of data and file carving.
Describe the events leading up to when you realised that you had been victimised by ransomware. Based on the content of the ransom note and the sample(s) of encrypted data provided to us, we will identify the family of ransomware that has infected your systems. Additionally, we will check if there is an existing decryptor for the identified family of ransomware.
Read-only forensic image(s) of the affected drive(s) will be taken. We will work exclusively from these forensic images while preserving the original(s) as evidence.
Next, we evaluate each potential avenue for recovery: (i) a known decryptor, (ii) Windows shadow copies, (iii) offline or cloud backups, (iv) unencrypted remnants of data, and (v) file carving.
If there’s a well-known weakness in an infection (or a published encryption key) then we can decrypt directly; otherwise we’ll rebuild your data from shadow copies, backup and/or other recoverable data sources.
Once we have all of the necessary components, we will restore your files, database(s), virtual machine(s) as needed based on which ones your company most wants/needs back online ASAP.
Once restored, we provide you with a list of what was recovered, you confirm it, and then we back-up the recovered data to a new external hard-drive for safe-keeping.
Your recovered data is delivered to you on clean media or securely transferred via internet for lower volume items; both ways are acceptable depending on your preference and needs.
Ransomware-affected data may be recovered from data storage devices (servers, NAS, RAID arrays, virtual machines, workstations, etc.); we identify the strain, preserve forensic evidence and attempt recovery using ALL possible avenues.
Tell us what happened and we will get back to you, usually within one working day.
We will be in touch shortly. For anything urgent, call 0117 332 1137.
There are no hidden fees and no pressure to buy, simply a detailed written price quote prior to any work being performed.
Below are examples of recent ransomware recovery projects completed across various server, NAS and workstation environments. The names were removed and details kept deliberately vague to protect the privacy of our clients.
The strain had a well-known vulnerability. We were able to image all of the disks as read-only, apply a decryptor, and restore both the databases and file shares fully.
Because the ransomware couldn’t remove the NAS’ snapshots, we were able to recover the protected versions, plus the unencrypted portion of the files, in full.
Since direct decryption wasn’t available, we were able to recover from shadow copies and an older offline backup, plus we were able to get some of the unencrypted portions of the files back.
All reviews posted on this website are based upon real customer responses; none have been created by us.
No invented reviews here — every testimonial we publish is genuine. Ask us to arrange a reference for a job like yours on 0117 332 1137.
Send us your device for a no-obligation free diagnostic and let us know what went wrong. One of our engineers will inspect it and confirm your exact quote in writing prior to doing any work.
To get started with recovering your data, first get your device to us. Wrap it securely, write your contact details on a slip of paper inside the package, include a brief description of what happened and post it to us. After running a complimentary diagnostic we will write to you confirming the exact price prior to starting work.
Do you want to post the device to us? We highly recommend using a trackable postal service with insurance. Would you prefer to deliver it yourself? That’s fine too. Our office hours for accepting deliveries are Monday to Friday, 9am to 5:30pm. Please make sure to wrap the device as described previously.
Need some additional information regarding our data recovery services? Fill out the form and provide further detail about your problem and one of our engineers will review it and offer you a personalised quote.
We’ll be in touch shortly. For anything urgent, call 0117 332 1137.
What people ask us most about after they have experienced a ransomware attack.
Often, but that is a function of the type of ransomware and how much damage was done. There are times when ransomware can be decrypted; where decryption is not possible we will generally restore your files through other means such as using Windows shadow copies, offline/cloud backups, and any unencrypted remnants of files left behind on your drive. The initial assessment gives you an idea of what options may exist for recovering your files.
Always obtain an assessment before paying. Payment does not guarantee that the attackers will provide a functioning decrypter, and also indicates to them that you may be willing to pay again, and it funds further attacks. In many ransomware events we have been able to restore the user’s data with no payment to the attacker.
Directly sometimes: some strains include bugs in their code (flaws) or have a published “key” to unlock an encrypted file for free. When there are no flaws in the encryption method and there has been no successful break-through of the encryption method, we will work with you to find ways to recover files from back-up methods as well as shadow copy files and other unencrypted file fragments.
Often yes. Ransomware often does not access files stored on offline external hard-drives, USB devices, or remote locations. The ransomware also frequently cannot access NAS snapshot backup images, or Windows shadow copies. In many cases, if backups were impacted, older versions of the files may still exist. Stop using the systems and call us now so we can try to recover anything before it is overwritten.
The first step is to identify which family of ransomware the attack belongs to by using a combination of the ransom note information along with some samples of the encryption. Next, we will see if a decryptor exists for this particular type of ransomware, including the free tools published through the No More Ransom project; again, regardless of the ransomware family, we research all possible routes to data recovery, and not just decryption.
Yes, we specialise in recovering encrypted data from servers, virtual machines, network attached storage (NAS) devices as well as RAID arrays. In each case, we create an image of each disk (if necessary rebuilding the RAID array), and restore the files/databases/mailboxes/file shares contained within those disks.
Yes, all ransomware recovery cases are treated with discretion and we are willing to enter into a non-disclosure agreement (NDA). Therefore your data and the fact you have been attacked remain confidential and will never be disclosed.
Typically, we provide a flat rate per hard drive. The initial rate is £950 + VAT for a single disk system. As previously mentioned, ransomware recovery pricing is determined on a per-case basis due to factors such as the ransomware strain used, amount of data being recovered and the complexity of the systems involved. A written quote will always be provided prior to commencing any work on your behalf and therefore you should expect no surprises.
There are several ways to deliver your hard drives to us. You may bring them directly to our offices located in Bristol Monday to Friday, 9am to 5:30pm. Alternatively, you may post them to us via postal delivery, fully insured. When delivering server/NAS devices, please extract the hard disk(s) and label clearly indicating its order/bay number etc. Also include your contact information, so we can schedule receipt of these items and before any work begins on your behalf, we will conduct a free diagnostic assessment on your behalf.
Proactive protection is rarely glamorous: backing up your data offline / versioned; keeping your operating system updated/patched; exercising healthy scepticism when opening attachments. Once you have already fallen victim to an attack: disconnect the device from your network immediately. Do not wipe and reinstall your operating system as this will likely destroy all existing copies of your data. Lastly do not rush to pay the ransom. Instead, submit your drive(s) for evaluation. Between shadow copy recovery, backup archaeology and potentially unencrypted remnants of data, there is often more recoverable than indicated by the ransom note itself. Additionally, prior to making any decisions regarding data recovery or payment of ransom, a free diagnostic evaluation will be performed to determine exactly what data remains recoverable.
Yes. It’s not uncommon. Our ransomware recovery specialists will be working with your insurers (and/or any incident response or breach teams) that they may hire to assist in recovering from a ransomware attack. We are able to create non-invasive, read only forensic images of your system(s), which allows us to recover your data while preserving all of the necessary evidence for your insurers to process your claim. In addition, we will document everything we recover, including which systems were impacted, which “strain” of ransomware was involved, as well as all data recovered; so that you will be prepared to provide your insurers with all of the information required to submit your claim. If you have cyber insurance, it would be best if you advise us at the earliest possible time. Some cyber insurance policies stipulate that there are only certain approved providers, and/or specific procedures that must be followed prior to commencing the recovery of your data. We will work within these parameters.
We first identify the strain, give you a written quote, then begin ransomware recovery from servers, NAS and workstations, with all evidence being preserved for your insurer. Contact us now.